Tag: devsecops
Secrets Sprawl and Rotation: A Practical Vault Management Playbook
Oreoluwa Omoike | | AI security, AI-assisted coding, API Key Security, AWS Secrets Manager, Azure Key Vault, CI/CD security, Cloud Security, credential exposure, Credential Rotation, Data Breaches, devsecops, Dynamic Secrets, GitGuardian, GitHub security, Google Secret Manager, hardcoded secrets, HashiCorp Vault, least-privilege, MCP Security, Model Context Protocol, non-human identities, secrets management, secrets sprawl, Security Boulevard, Terraform securityIn 2025 alone, security firm GitGuardian detected 28.65 million new hardcoded secrets exposed in public GitHub commits — a 34% increase year over year and the largest single-year jump the company has ...
HackerOne Report Surfaces Massive Increase in Vulnerability Backlogs
Mike Vizard | | AI security, AI vulnerability discovery, application security, appsec, bug bounty, cyber risk, Cybersecurity, devsecops, exploit development, exposure debt, HackerOne, output handling, prompt leakage, remediation backlog, security researchers, software security, vulnerability backlog, vulnerability management, vulnerability remediation, VulnOpsHackerOne research shows vulnerability remediation is getting faster, but AI-driven discovery is expanding exposure debt even more quickly, putting DevSecOps teams under growing pressure ...
Security Teams Are Fixing Vulnerabilities Faster Than Ever. So Why Is Software Getting Riskier?
Mitchell Johnson | | AI coding agents, AI Development, application security, automated remediation, CI/CD, dependency security, dependency selection, developer experience, devsecops, open source security, secure coding, secure software development, security policy, shift left security, software composition analysis, software risk, Software Supply Chain, technical debt, vulnerability backlog, vulnerability managementAI is speeding up dependency decisions, making point-of-selection security essential for reducing vulnerable components, downstream tickets and avoidable rework ...
GitHub Slams the Brakes on Private Vulnerability Reports
Drowning in AI-generated bug reports? GitHub has a radical answer: Stop accounts from reporting them. GitHub’s new limits on bug reports aren't a solution to the AI bug-report flood. Anything but! They're ...
DevOps Dozen 2026 Nominations Are Open: Recognizing the People and Technology Moving DevOps Forward
Alan Shimel | | agentic AI, AgentOps, AI software development, CI/CD, developer productivity, DevOps 2026, DevOps awards, devops dozen, DevOps Dozen Awards, devsecops, FinOps, internal developer platforms, LLMOps, MLOps, observability, open source, platform engineering, software delivery, Software Supply Chain SecurityWhen we launched the DevOps Dozen in 2015, we wanted to recognize the people, projects and companies helping this community move forward. We saw the work happening across DevOps every day at ...
AWS Benchmark Aims to Reduce Number of False Positives Found by AI Vulnerability Scanners
Amazon Web Services (AWS) has developed a benchmark that can be used to test whether a model can distinguish real vulnerabilities from code that looks risky but is actually safe. The Deception ...
Survey: Lack of Confidence in Software Supply Chain Security Runs High
A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (15%) in the ...
GitHub’s Security Autofix Agent Now Remembers What It Fixed
Tom Smith | | agentic autofix, AI coding agents, AI security, application security, code scanning, CodeQL, Copilot Memory, devsecops, github, GitHub Advanced Security, GitHub Copilot, repository memory, secure coding, vulnerability remediationGitHub’s agentic autofix now uses Copilot Memory to reuse repository-specific security fix patterns, helping Copilot apply lessons from past vulnerabilities across future alerts, reviews and coding workflows ...
Leaked GitLab Email Tokens Can Reach Code, Secrets and CI/CD Pipelines
Jaime Hampton | | Aikido Security, application security, CI/CD, devsecops, gitlab, Software Supply ChainSecurity researchers have uncovered a GitLab behavior that could let attackers use a leaked project email address to push code, trigger CI/CD jobs and reach other repositories accessible to the address owner ...
Blitzy Makes Sandbox for Reverse Engineering Code Available at No Cost
Blitzy has made available a sandbox where DevOps teams can reverse-engineer up to one million lines of code, generate up to 25,000 lines of tested end-to-end code, and identify security vulnerabilities across ...
Why Old Azure DevOps Releases Survive a Pipeline Cutover
Ahmed Tariq | | Azure DevOps, Azure DevOps Classic, Azure pipelines, CI/CD, container security, deployment automation, devops, devsecops, Helm, kubernetes, Kubernetes security, Pipeline Migration, release management, Release Pipelines, software deliveryOld Azure DevOps Classic releases can retain retired deployment tasks, Helm names, image paths and variables long after a pipeline cutover, leaving stale redeploy paths active ...
DevSecOps Teams as Partners in Secure Software Delivery
Manish Shetty | | application security, CI/CD, CI/CD security, dependency security, devops security, devsecops, risk management, secure software development, security automation, Security Guardrails, shift left security, software security, Software Supply Chain, vulnerability managementDevSecOps teams can reduce last-minute release delays by shifting security decisions earlier, improving guardrails, clarifying ownership and making findings actionable ...
